Core Services Logging

Your Workspace ONE UEM deployment has several essential, or core, services that enable your deployment to run successfully. These services include the console, device services, API, and AWCM. To help you diagnose problems, VMware provides logging data if you have issues with any of these core services.

The core services of Workspace ONE UEM are its foundation, the pieces required for your deployment to run properly and efficiently. If the service you need assistance with does not display here, view the Integrated Component Logging section for an extensive list of integrated services and their log information.

There are two logging levels that provide different levels of detail. To reduce the use of hardware resources, deactivate the logging level if you are not troubleshooting a service.

In the console with a system administrator level account at the global organization group, navigate to Groups & Settings > All Settings > Admin > Diagnostics > Logging.
Select a service that needs an increased logging level. Set the service logging to Enabled.
After you finish troubleshooting, revert the logging level to Disabled to preserve hardware resources.

Important:

For assistance with SaaS environments, contact VMware Support as these configurations are only accessible in on-premises environments.

How to Read a Workspace ONE UEM Log Entry

The ability to read a Workspace ONE UEM log entry is key to successfully analyzing and troubleshooting any issues you might encounter with your Workspace ONE UEM deployment.

Every log entry contains the following key information.

Date and time
Server identifier
Server communication thread identifier
Device or user identifier
Workspace ONE UEM thread identifier
Logging level
Associated service
Log message

Error Log Example

Workspace ONE UEM error logs use the following format:

2017/06/21 19:07:12.243[1]	EX-DS111[2]	11aaabbccc-dddee-1111-22ff-06gggg777777[3]	[0000000-0000000][4]   (14)[5] 	Error[6]	AirWatch.CloudConnector.Client.AccServiceClient.SendRequest[7] 	Received a Failure message from AWCM: Destination not reachable at this moment[8]

Information Log Example

Workspace ONE UEM Information logs use the following format:

2017/09/07 14:46:57.852[1]             EX-DS111[2]           ca9562a7-c87c-4c3b-a1e1-ca35a88555ab[3]               [0000052-0000000][4]   (20)[5]             Info[6]                WanderingWiFi.AirWatch.Console.Web.Controllers.HomeController[7]          Method: WanderingWiFi.AirWatch.Console.Web.Controllers.HomeController.Index; LocationGroupID: 7; UserID: 52; UserName: TEST_USER; Parameters: <N/A>;  69eddd96-9a81-47e9-a78a-dd20c845426b

Console Logging

Learn more about the Workspace ONE UEM logging functions available for the Console service. The API service is installed by default. All Logs are located in the <installdrive>:/AirWatch/Logs folder unless otherwise specified.


Folder	Log Name	Description
AirWatch API	AW_Core_Api.log	Contains information on calls made to the API endpoint for available API commands.
AirWatch API	AW_MAM_Api.log	Contains information relating to specifically the /API/MAM endpoint.
AirWatch API	AW_MCM_Api.log	Contains information relating to specifically the /API/MCM endpoint.
AirWatch API	AW_MDM_Api.log	Contains information relating to specifically the /API/MDM endpoint.
AirWatch API	AW_MEM_Api.log	Contains information relating to specifically the /API/MEM endpoint.
AirWatch Services	AWServices.log	Contains information on the AirWatch SOAP API.
DesiredStateManagement	DSM.log	Contains information about Windows 10 Device State Management.
IIS>W3SVC1	u_ex####.log	Contains the history of IIS web endpoints accessed and response codes delivered (Example: /AirWatch & /Enroll).
C:/ > Inetpub > Logs > FailedReqLogFiles	Fr####.xml	Contains failed IIS request log traces. The log is deactivated by default. You must enable it.
Services	AirWatchGemAgent.log	Contains information on the GEM License assessing service and its back-end connections.
Services	ApiWorkflowService.log	This service log cites processed device commands from the REST API.
Services	AW.Meg.Queue.Service.log	Contains information on the email policy updates for SEG or Powershell integration, associated MSMQ reader information, SQL connection errors, and encryption ciphers.
Services	AW.IntegrationService.log	Contains information on all AW third-party integrations such as Apple School Manager APIs, VPP, and App Scan.
Services	BackgroundProcessorServiceLogFile.txt	Contains information on multiple different jobs that are processed in the background asynchronously such as console exports or report generation.
Services	BulkProcessingServiceLogFile.txt	Contains information on bulk commands such as SDK, certificates, APNS messages, DEP APIs, command queues, users, user groups, profiles, and apps.
Services	ChangeEventOutboundQueueService.log	Sends event notifications from source component to a central location (Example: Syslog).
Services	ChangeEventQueue.log	Contains information on event log entries, the batch save of those logs, syslog configuration loads, and policy updates for AW Tunnel.
Services	ComplianceService.log	Contains information about device compliance status and actions executed as part of compliance policies.
Services	ContentDeliveryService.log	Contains information on content delivery and relay server communication for product provisioning.
Services	DirectorySyncServiceLogFile.txt	Contains information on directory user and group syncs such as member lists and LDAP mapping and definitions.
Services	EntityReconcileService.log	Contains information on reconcile and sync for entities linked to smart groups.
Services	MessagingServiceLog.txt	Contains information on notifications sent to the various 3rd party messaging services (APNs, GCM, WNS).
Services	PolicyEngine.log	Contains information on the device policies queue and products information related to user, OG, and device compliance. It will also include information on product provisioning processing and delivery.
Services	PurgeUtility.log	Contains information on purge tasks and job run status.
Services	SchedulerService.log	Contains information on the various jobs that are executed by the scheduler service such as Automatic sync, VPP user invite sync, bulk notification push, and AD sync triggers. For an exhaustive list, see Groups & Settings > All Settings > Admin > Scheduler.
Services	SmartGroupServiceLogFile.txt	Contains information relating to reconciliation of smart group mappings resulting from enrollments, changes in device or user state, and reports the resulting change for smart groups.
Services	SMSService.log	Contains information on batch SMS sent to devices.
Services	Ws1.Tunnel.Kestrel.log	Tunnel services logs related to .net core based microservices.
Tools	DeviceStateMigrationTool.log	Contains information on legacy android device migration.
Tools	EntitlementServiceMigrationTool.log	Contains information on legacy android device migration.
Web console	WebLogFile.txt	Contains information on the console user interface.
TargetedLogging	####Airwatch.log TargetedLogging_<servicename>.log	Contains information on targeted logging enabled devices or services.

Device Services and Self-Service Portal Logging

Learn more about the Workspace ONE UEM logging functions available for Device Services. The API service is installed by default. All Logs are located in the <installdrive>:/AirWatch/Logs folder unless otherwise specified.


Folder	Log Name	Description
AirWatch API	AW_Core_Api.log	Contains information on calls made to the API endpoint for available API commands.
AirWatch API	AW_MAM_Api.log	Contains information relating to specifically the /API/MAM endpoint.
AirWatch API	AW_MCM_Api.log	Contains information relating to specifically the /API/MCM endpoint.
AirWatch API	AW_MDM_Api.log	Contains information relating to specifically the /API/MDM endpoint.
AirWatch API	AW_MEM_Api.log	Contains information relating to specifically the /API/MEM endpoint.
AirWatch API	ws1.gateway.log	WS1-Services logs.
AirWatch Services	AWServices.log	Contains information on the AirWatch services including logging level and service details. This log also contains SOAP API related information.
AppCatalog	AppCatalogLogFile.txt	Contains information related to the application catalog such as application assignment, device requests when loading the app catalog, and user authentication.
DesiredStateManagement	DSM.log	Contains information about Windows 10 Device State Management.
DeviceManagement	DeviceManagement.log	Contains information on the early stages of enrollment including token or group ID validation, restriction checks, and authentication.
DeviceServices	DeviceServicesLog.txt	Contains information related to all device communications with Workspace ONE UEM.
DeviceService	DevicesGateway.log	Logging for the subset of APIs dedicated to devices.
Enroll Shortcut	EnrollShortcut.log	Information on URL redirects such as /enroll.
EntitlementService	VMware.UEM.EntitlementService.Log	Contains information on the provided APIs to create entitlement rules.
IdentityService	IdentityService.log	Information about the SAML web endpoint.
IIS>W3SVC1	u_ex####.log	Contains history of IIS web endpoints accessed and response codes delivered (Example: /DeviceServices & /DeviceManagement).
C:/ > Inetpub > Logs > FailedReqLogFiles	Fr####.xml	Contains failed IIS request log traces. This log must be enabled as it is turned off by default.
MetadataTransformService	Metadatatransfromservice.log	Contains information on the stored metadata used to render the data driven user interface.
MyDevice	WebLogfile.txt	Contains information on actions taken within the self-service portal.
Services	ws1tunnel.kestrel	All the DB queries from Microservice. Log level is OFF by default.
Services	ws1.tunnel.log	Tunnel Microservice application/functional logs. These logs also contain the equivalent of IIS logs about API status, time taken, etc.
Services	APIWorkflowService.log	Contains information on the API such as logging level, MSMQ reader errors, and SQL connection errors.
Services	AW.IntegrationService.log	Contains information on all AW third-party integrations such as Apple School Manager APIs, VPP, and App Scan.
Services	AW.Meg.Queue.Service.log	Contains information on the email policy updates for SEG or Powershell integration, associated MSMQ reader information, SQL connection errors, and encryption ciphers.
Services	BulkProcessingServiceLogFile.txt	Contains information on bulk commands related to SDK, certificates, APNS messages, DEP APIs, command queues, users, user groups, profiles, and apps.
Services	ChangeEventQueue.log	Contains information on event log entries, the batch save of those logs, syslog configuration loads, and policy updates for AW Tunnel.
Services	EntityReconcileService.log	Contains information on reconcile and sync for entities linked to smart groups.
Services	InterrogatorQueueService.log	Contains information related to processed device samples for all platforms to be updated to the DB such as Application and Profile samples from device.
Services	MessagingServiceLog.txt	Contains information on sends and response times to the various third-party messaging services (APNs, GCM, WNS).
Services	ProvisioningPackageServicelogfile.txt	Logs provisioning package information for auto enrollment of applicable Windows 10 device.
Services	ChangeEventOutboundQueueService.txt	Sends event notifications from source component to a central location (Example: Syslog).
Services	SmartGroupServiceLogfile.log	Information relating to reconciliation of smart group mappings resulting from enrollments or changes in device or user state, and the resulting change for smart groups.
TargetedLogging	####Airwatch.log TargetedLogging_<servicename>.log	Contains information on targeted logging enabled devices or services.
Trust Service	TrustService.log	Logging associated with an on-premises instance of the Trust Service that is used for Certificate Pinning.

API Logging

Learn more about the Workspace ONE UEM logging functions available for the API service. All Logs are located in the <installdrive>:/AirWatch/Logs folder unless otherwise specified.


Folder	Log Name	Description
AirWatch API	AW_Core_Api.log	Contains information on calls made to the API endpoint for available API commands.
AirWatch API	AW_MAM_Api.log	Contains information relating to specifically the /API/MAM endpoint.
AirWatch API	AW_MCM_Api.log	Contains information relating to specifically the /API/MCM endpoint.
AirWatch API	AW_MDM_Api.log	Contains information relating to specifically the /API/MDM endpoint.
AirWatch API	AW_MEM_Api.log	Contains information relating to specifically the /API/MEM endpoint.
AirWatch API	CiscoiseLogfile.txt	Information about CiscoISE integration.
AirWatch API	ws1.gateway.log	Information about devicesgateway API.
AirWatch Services	AWServices.log	Contains information on the Workspace ONE UEM services including logging level and service details. This log also contains SOAP API-related information.
IIS>W3SVC1	u_ex####.log	Contains history of IIS web endpoints accessed and response codes delivered (Example: /ActiveSyncIntegrationServiceEndPoint).
C:/ > Inetpub > Logs > FailedReqLogFiles	Fr####.xml	Contains failed IIS request log traces. This log must be enabled as it is turned off by default.
Services	APIWorkflowService.log	Contains information on handing bulk requests from the API server such as bulk commands to devices.
Services	AW.IntegrationService.log	Contains information on all AW third-party integrations such as Apple School Manager APIs, VPP, and App Scan.
Services	AW.Meg.Queue.Service.log	Contains information on the email policy updates for SEG or Powershell integration, associated MSMQ reader information, SQL connection errors, and encryption ciphers.
Services	BulkProcessingServiceLogFile.txt	Contains information on bulk commands related to SDK, certificates, APNS messages, DEP APIs, command queues, users, user groups, profiles, and apps.
Services	ChangeEventQueue.log	Contains information on event log entries, the batch save of those logs, and syslog configuration loads.
Services	EntityReconcileService.log	Contains information on reconcile and sync for entities linked to smart groups.
Services	MessagingServiceLog.txt	Contains information on sends and response times to the various third-party messaging services (APNs, GCM, WNS).
Services	ChangeEventOutboundQueueService.txt	Log file for entering information into the MSMQ to be sent to central outbound component (Example: Syslog).
Services	SmartGroupServiceLogfile.log	Information relating to reconciliation of smart group mappings resulting from enrollments or changes in device or user state, and the resulting change for smart groups.
Services	DataPlatformService.log	Information about sending Windows 10 samples (requires Workspace ONE Intelligence).

AWCM Logging

Learn more about the Workspace ONE UEM logging functions available for the AWCM service. All Logs are located in the /VMware/AirWatch/Logs folder unless otherwise specified.


Folder	Log Name	Description
AWCM	Awcm.log	Contains information on AWCM such as status, history, properties, and additional sub-services.
AWCM	AWCMservice.log	Contains log information on AWCM Java service wrapper.